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Abstract. Suppose we have n algorithms, quantum or classical, each 
computing some bit-value with bounded error probability. We describe 
a quantum algorithm that uses 0[y/n) repetitions of the base algo- 
rithms and with high probability finds the index of a 1-bit among these 
n bits (if there is such an index). This shows that it is not necessary 
to first significantly reduce the error probability in the base algorithms 
to 0(l/poly(n)) (which would require O(^nlogn) repetitions in total). 
Our technique is a recursive interleaving of amplitude amplification and 
error-reduction, and may be of more general interest. Essentially, it shows 
that quantum amplitude amplification can be made to work also with a 
bounded-error verifier. As a corollary we obtain optimal quantum upper 
bounds of 0{^/N) queries for all constant-depth AND-OR trees on TV 
variables, improving upon earlier upper bounds of 0(\/iVpolylog(A'')). 



1 Introduction 

One of the main successes of quantum computing is Grover's algorithm |10I7| . It 
can search an n-element space in O(y^) steps, which is quadratically faster than 
any classical algorithm. The algorithm assumes oracle access to the elements in 
the space, meaning that in unit time it can decide whether the zth element 
is a solution to its search problem or not. In some more realistic settings we 
can efficiently make such an oracle ourselves. For instance, if we want to decide 
satisfiability of an m-variable Boolean formula, the search space is the set of 
all n = 2™ truth assignments, and we can efficiently decide whether a given 
assignment satisfies the formula. However, in these cases the decision is made 
without any error probability. In this paper we study the complexity of quantum 
search if we only have bounded-error access to the elements in the space. 

More precisely, suppose that among n Boolean values /i , . . . , /„ we want to 
find a solution (if one exists), i.e., an index j such that fj — 1. For each i we have 
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at our disposal an algorithm Fi that computes the bit fi with two-sided error: if fi 
is 1 then the algorithm outputs 1 with probability, say, at least 9/10, and if fi = 
then it outputs with probability at least 9/10. Grover's algorithm is no longer 
applicable in this bounded-error setting, at least not directly, because the errors 
in each step will quickly add up to something uncontrollably large. Accordingly, 
we need to do something different to get a quantum search algorithm that works 
here. We will measure the complexity of our quantum search algorithms by the 
number of times they call the underlying algorithms Fi. Clearly, the f2{^/n) lower 
bound for the standard error- less search problem, due to Bennett, Bernstein, 
Brassard, and Vazirani 4 , also applies to our more general setting. Our aim is 
to give a matching upper bound. 

An obvious but sub-optimal quantum search algorithm is the following. By 
repeating Fi k — O(logn) times and outputting the majority value of the k 
outcomes, we can compute fi with error probability at most 1/lOOn. If we then 
copy the answer to a safe place and reverse the computation to clean up (most of) 
the workspace, then we get something that is sufficiently "close" to perfect oracle 
access to the fi bits to just treat it as such. Now we can apply Grover's algorithm 
on top of this, and because quantum computational errors add linearly the 
overall difference with perfect oracle access will be negligibly small. This solves 
the bounded-error quantum search problem using 0{y/nlogn) repetitions of the 
i^i's, which is an 0(log n)-factor worse than the lower bound. Below we will refer 
to this algorithm as "the simple search algorithm" . 

A relatively straightforward improvement over the simple search algorithm is 
the following. Partition the search space into n/ log^ n blocks of size log^ n each. 
Pick one such block at random. We can find a potential solution (an index j in the 
chosen block such that fj = 1 , if there is such a j) in complexity 0(log n log log n) 
using the simple search algorithm, and then verify that it is indeed 1 with er- 
ror probability at most 1/n using another 0(log?i) invocations of Fj. Applying 
Grover search on the space of all n/ log^ n blocks, we obtain an algorithm with 

complexity 0{^J nj log^ n) • 0(lognloglogn -f logn) = O(-ynloglogn). 

A further improvement comes from doing the splitting recursively: we can 
use the improved upper bound to do the computation of the "inner" blocks, 
instead of the simple search algorithm. Using T(n) to denote the complexity on 
search space of size n, this gives us the recursion 

T{n) <d(T{log''n)^l^^ + logn^ 

for some constant d > 0. This recursion resolves to complexity 0[yfn ■ c'°s ") 
for some constant c > 0. It is similar to (and inspired by) the communication 
complexity protocol for the disjointness problem of H0yer and de Wolf III] . 

Apart from being rather messy, this improved algorithm is still not optimal. 
The main result of this paper is to give a relatively clean algorithm that uses the 
optimal number 0{^Jn) of repetitions to solve the bounded-error search problem. 
Our algorithm uses a kind of "carrot-and-stick" approach that may be of more 
general interest. Roughly speaking, it starts with a uniform superposition of all 



Fi. It then amplifies all branches of the computation that give answer 1. These 
branches include solutions, but they also include "false positives": branches cor- 
responding to the 1/10 error probability of F^'s where fi = 0. We then "push 
these back" by testing whether a 1-branch is a real positive or a false one (i.e., 
whether fi = I or not) and removing most of the false ones. Interleaving these 
amplify and push-back steps properly, we can amplify the weight of the solutions 
to a constant using 0{^/n) repetitions. At this point we just do a measurement, 
see a potential solution j, and verify it classically by running Fj a few times. 

As an application of our bounded-error quantum search algorithm, in Sec- 
tion0]we give optimal quantum algorithms for constant-depth AND-OR trees in 
the query complexity setting. For any constant d, we need only 0{y/N) queries 
for the d-level AND-OR tree, improving upon the earlier 0{-\fN (log N)'^~^) algo- 
rithms of Buhrman, Cleve, and Widgerson Matching lower bounds of Q{^fN) 
were already shown for such AND-OR trees, using Ambainis' quantum adversary 
method |ll2j . Finally, in Section |S1 we indicate how the ideas presented here can 
be cast more generally in terms of amplitude amplification. 



2 Preliminaries 



Here we briefly sketch the basics and notation of quantum computation, referring 
to the book by Nielsen and Chuang ~V1 for more detail. An m-qubit state is a 
linear combination of all classical m-bit states 

\4>) = 

iG{0,l}'" 

where \i) denotes the basis state i (a classical m-bit string), the amplitude Ui is 
a complex number, and lo^iP — 1- We view |^) as a 2 ""-dimensional column 
vector. A measurement of state \4>) will give \i) with probability la^P, and the 
state will then collapse to the observed A non-measuring quantum operation 
corresponds to applying a unitary [— linear and norm-preserving) transformation 
U to the vector of amplitudes. If |0) and \ip) are quantum states on m and m' 
qubits, respectively, then the two-register state \4>) ® \^) = corresponds 
to the 2™+'" -dimensional vector that is the tensor product of 10) and 1-0). 

The setting of query complexity is as follows. For input x £ {0, 1}", a query 
corresponds to the unitary transformation O that maps |z, 6, z) —> |i, 6 © Xj, z). 
Here i E [n] and b E {0, 1}; the z-part corresponds to the workspace, which 
is not affected by the query. A T-query quantum algorithm has the form A = 
UtOUt-1 ■ ■ ■ OUiOUq, where the Uk are unitary transformations, independent 
of X. This A depends on x only via the T applications of O. The algorithm 
starts in initial all-zero state |0) and its output (which is a random variable) is 
obtained from observing some dedicated part of the final superposition A\0). 



3 Optimal Quantum Algorithm for Bounded-Error Search 



In this section we describe our quantum algorithm for bounded-error search. 
The foUowing two facts generahze, respectively, the Grover search and the error- 
reduction used in the algorithms we sketched in the introduction. 

Fact 1 (Amplitude amplication [j8j) Let Sq be the unitary that puts a '-'in 
front of the all-zero state \0), and Si be the unitary that puts a '-'in front of 
all basis states whose last qubit is Let A\0) = sin(6')|(/)i)|l) -f cos(6')|(/)o)|0) 
where angle 9 is such that < 9 < 7r/2 and sin^(^) equals the probability that a 
measurement of the last register of state A\0) yields a '1'. Set G = —ASaA~^ Si. 
Then GA\0) = sin(36')|0i)|l) cos(36')|(?!)o)|0). 

Amplitude amplification is a process that is used in many quantum algo- 
rithms to increase the success probability. Amplitude amplification effectively 
implements a rotation by an angle 29 in a two-dimensional space (a space differ- 
ent from the Hilbert space acted upon) spanned by and |(/>o)|0). Note that 
we can always apply amplitude amplification regardless of whether the angle 9 
is known to us or not. 

Fact 2 (Error-reduction) Suppose A\0) = ^\(l)b)\b) + Vl~^|0i-b)|l - b), 
where b e {0,1} and p > 9/10. Then using 0(log(l/e)) applications of A 
and majority-voting, we can build a unitary E such that E\Q) — ^/q\il'b)\b) + 
y/1 — (7|'0i_b) |1 — b) with q > 1 — e, and IV'b/i-h) possibly of larger dimension 
than \4>b/i-b) (because of extra workspace). 

We will recursively interleave these two facts to get a quantum search algo- 
rithm that searches the space /i, ...,/„ G {0, 1}. We assume each fi is computed 
by unitary Fi with success probability at least 9/10. Let F = {j : fj — 1} be the 
set of solutions, and t = \F\ its size (which is unknown to our algorithm). The 
goal is to find an element in if t > 1, and to output 'no solutions' if t = 0. 

We will build an algorithm that has a superposition of all j £ [n] in its first 
register, a growing second register that contains workspace and other junk, and 
a 1-qubit third register indicating whether something is deemed a solution or 
not. The algorithm will successively increase the weight of the basis states that 
simultaneously have a solution in the first register and a 1 in the third. 

Consider an algorithm A that runs all Fi once in superposition, producing 
the state A\0), which we rewrite as 

1 " 

^El^) (v^IV'm)|1) + v/i^IV'^o)|0)) =sin(0)|0i)|l)+cos(0)|(^o)|O), 

where pi is the probability that Fi outputs 1, the states \ipi,b) describe the 
workspace of the Fi, and sm{9)^ = X^iLiPi — 9i/10n. 

The idea is to apply a round of amplitude amplification to A to amplify the 
|l)-part from sm{9) to sm{39). This will amplify both the good states |j)|l) for 
j £ F and the "false positives" |j)|l) for j ^ T by a factor of sin(36')/ sin(^) w 3 



(here we didn't write the second register). We then apply an error-reduction step 
to reduce the amphtude of the false positives, setting "most" of its third register 
to 0. These two steps together form a new algorithm that puts almost 3 times 
as much amplitude on the solutions as A does, and that puts less amplitude on 
the false positives than A. We then repeat the amplify-reduce steps on this new 
algorithm to get an even better algorithm, and so on. 

Let us be more precise. Our algorithm will consist of a number of rounds. In 
round k we will have a unitary A/, that produces 



Ak\0) = + f3k\rk)\l) + ^l-al- /3l\Hk)\0), 

where ak, Pk are non-negative reals, 1 1^) is a unit vector whose first register only 
contains j G F, jT/j) is a unit vector whose first register only contains j ^ F, 
and \Hk) is a unit vector. If we measure the first register of the above state, we 
will see a solution (i.e. some j G F) with probability at least q;|. Ai is the above 
algorithm A, which runs the Fi in superposition. Initially, > 9t/10n since 
each solution contributes at least 9/lOn. We want to make the good amplitude 
ak grow by a factor of almost 3 in each round. 

Amplitude amplification step. For each round k, define 9k G [0,7r/2] by 
sm{9k)^ = + 0^. Applying amplitude amplification {Gk = — A^^SqA'^'^ S\) 
gives us the state GkAk\Q), which we may write as 



sin(36>fc) sin(36lfc) - / ( sin(36lfc) y 

+ ^hW^'^'^'^^"^^ + V l^R^j K + /3.)l^0|o). 

We applied Ak twice and A'^^ once, so the complexity goes up by a factor of 3. 

Error-reduction step. Conditional on the qubit in the third register being 

1, the error-reduction step Ek now docs majority voting on 0{k) runs of the Fj 
(for all j in superposition) to decide with error at most 1/2*^+^ whether fj = 1. 
It adds one 0-qubit as the new third register and maps (ignoring its workspace, 
which is added to the second register) 

i^fc|j)|l)|0) = a,,|j)|l)|l) + ^l-a|,|j)|l)|0) 

^^fcli)|o)|o) = |i)|o)|o) 

where a]^ > I - l/2'=+5 if = 1 and a^^ < l/2'=+5 if fj = 0. This way, Ek 
removes most of the false positives. 



Putting Ak+i = EkGkAk and defining a^+i, /3fe+i, lA+i), iTfe+i), and \Hk+\) 
appropriately, we now have 



Ak+i\0) = afc+i|A+i)|l) + (3k+i\rk+i)\l) + ^1 - - Pl^^\Hk+im. 



Here the second register has grown by the workspace used in the error-reduction 
step Ek, as well as by the qubit that previously was the third register. The good 
amplitude has grown in the process: 

sin(6'fe) V 



Since x — < sin(a;) < x, we have 

sin(36lfc) 
sin(6ifc) 



> 3 - 901/2. 



Accordingly, as long as dk is small, ak will grow by a factor of almost 3 in each 
round. On the other hand, the weight of the false positives goes down rapidly: 

sin(36'fc) 1 

Pk+l S Pk- 



sin(6»fc) 



Wc now analyze the number m of rounds that we need to make the good am- 
plitude large. In general, we have sin(6'/c)^ = + hence 0^ < 2(a^ + /3^) for 
the domain we are interested in. Here < 9^~^a\ and /3| < ^(9/2^)*^"^. Note 



m— 1 m—1 



k=l k=l 

m—1 m—1 ^ 

<2^9'=-X + 2^^(9/2«)'=-^ 



10^ 

fc=i fe=i 
< 2-9'"-ia? + l/4. 

Therefore, m rounds of the above process amplifies the good amplitude ak to 
j^J-^ sin(6»fc) V 

m — 1 

> ai n (3 - 9^fc/2) (1 - 1/2'+') 

k=l 

m—1 

= ai3™-i n (1 - 3^i/2) (1 - 1/2'^+') 
fe=i 

(„ m-l rn - 1 \ 

fe=i fe=i / 

> aiS^-i ( 1 - ^(2 • 9^-iaf + 1/4) - 1/16 



>ai3™-i(l/2-3-9™-iaf). 



In particular, whenever the (unknown) number t of solutions lies in the interval 

[n/9'"+\n/9™], equivalently 9" G [n/9t,n/t], then we have 



This implies 



, 9t t I 

'TlO ~ V lOn - V n - 3™ 



a™ > 0.04, 



so the probability of seeing a solution after m rounds is at least 0.0016. By 
repeating this classically a constant number of times, say 1000 times, we can 
bring the success probability close to 1 (note to avoid confusion: these 1000 
repetitions are not part of the definition of Am itself) . 

The complexity Ck of the operation , in terms of number of repetitions of 
the Fi algorithms, is given by the recursion 

Ci = 1 and Cfe+i = iCk + 0(fc), 

where the 3Cfe is the cost of amplitude amplification and 0{k) is the cost of 
error-reduction. This imphes = 0{Y.k~^ k ■ 3™"'=-!) = 0(3'"). 

We now give the full algorithm when the number of solutions is unknown: 



Algorithm: Quantum search on bounded-error inputs 

1. for m = to [logg(n)] — 1 do: 

(a) run A„i 1000 times 

(b) verify the 1000 measurement results, each by O(logn) runs of the corre- 
sponding Fj 

(c) if a solution has been found, then output a solution and stop 

2. Output 'no solutions' 



This finds a solution with high probability if one exists. The complexity is 

riog9(n)l~l 

J2 1000 • 0(3") + 1000 • 0(log7i) ^ 0(3'°S9(»)) = 0{^/^). 

m=0 

If we know that there is at least one solution but we don't know how many there 
are, then, using a modification of our algorithm as in jT,, we can find a solution 
using an expected number of repetitions in 0{yj N /t), where t is the (unknown) 
number of solutions. This is quadratically faster than classically, and optimal for 
any quantum algorithm. 



4 Optimal Upper Bounds for AND-OR Trees 



A d- level AND-OR tree on N Boolean variables is a Boolean function that is 
described by a depth-d— 1 tree with interleaved ORs and ANDs on the nodes and 



the N input variables as leaves. More precisely, a 0-level AND-OR tree is just an 
input variable, and if /i , . . . , /„ all are d-level AND-OR trees on m variables, each 
with an AND (resp. OR) as root, then OR(/i, . . . , /„) (resp. AND) is a (d + 1)- 
level AND-OR tree on = nm variables. AND-OR trees can be converted easily 
into OR- AND trees and vice versa using De Morgan's laws, if we allow negations 
to be added to the tree. 

Consider the two-level tree on N — variables with an OR as root, ANDs 
as its children, and fanout n in both levels. Each AND-subtree can be quantum 
computed by Grover's algorithm with one-sided error using 0{^/n) queries (we 
let Grover search for a '0', and output 1 if we don't find any), and the value of 
the OR- AND tree is just the OR of those n values. Accordingly, the construction 
of the previous section gives an 0{\pn- \pn) = 0{-\/N) algorithm with two-sided 
error. This is optimal up to a constant factor 1 . 

More generally, for d-level AND-OR trees we can apply the above algorithm 
recursively to obtain an algorithm with 0{c'^^^\/N) queries. Here c is the con- 
stant hidden in the 0{ ) of the result of the previous section. For each fixed 
d, this complexity is 0{^/N), which is optimal up to a constant factor [2]. It 
improves upon the 0{^/N{logNY~^) algorithm given in 

Our query complexity upper bound also implies that the minimal degree 
among iV-variate polynomials approximating AND-OR is 0{y/N) 0. Whether 
this upper bound on the degree is optimal remains open. The best known lower 
bound for the 2-level case is Q{N^/^^/\ogN) 

5 Amplitude Amplification with Imperfect Verifier 

In this section we view our construction in a more general light. 

Suppose we are given some classical randomized algorithm A that succeeds 
in solving some problem with probability p. In addition, we are given a Boolean 
function x that takes as input an output from algorithm A, and outputs whether 
it is a solution or not. Then, we may find a solution to our problem by repetition. 
We first apply algorithm A, obtaining some candidate solution, which we then 
give as input to the verifier x- If X outputs that the candidate indeed is a solution, 
we output it and stop, and otherwise we repeat the process by reapplying A. 
The probability that this process terminates by outputting a solution within the 
first 0{^) iterations of the loop, is lower bounded by a constant. 

A quantum analogue of boosting the probability of success is to boost the 
amplitude of being in a certain subspace of a Hilbert space. Thus far, amplitude 
amplification jBj has assumed that we are given a perfect verifier x'- whenever a 
candidate solution is found, we can determine with certainty whether it is a solu- 
tion or not. Formally, we model this by letting x be computed by a deterministic 
classical subroutine or an exact quantum subroutine. 

The main result of this paper may be viewed as an adaptation of amplitude 
amplification to the situation where the verifier is not perfect, but sometimes 
makes mistakes. Instead of a deterministic subroutine for computing x, we are 



given a bounded-error randomized subroutine, and instead of an exact quan- 
tum subroutine, we are given a bounded-error quantum subroutine. Previously, 
the only known technique for handling such cases has been by straightforward 
simulation of a perfect verifier: construct a subroutine for computing x with er- 
ror by repeating a given bounded-error subroutine of order 0{k) times and 
then use majority voting. Using such direct simulations, we may construct good 
but sub-optimal quantum algorithms, like the 0{^/n\ogn) query algorithm for 
quantum search of the introduction. Here, we have introduced a modification of 
the amplitude amplification process that allows us to efficiently deal with im- 
perfect verifiers. Essentially, our result says that imperfect verifiers are as good 
as perfect verifiers (up to a constant multiplicative factor in the complexity). 
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